CVE-2026-55548

Name of the Vulnerable Software and Affected Versions Yamcs versions prior to 5.12.8 Yamcs versions prior to 5.13.2

Description The PacketsApi.exportPackets endpoint in yamcs-core/src/main/java/org/yamcs/http/api/PacketsApi.java fails to enforce object-level ReadPacket privileges when a request omits specific packet names. When an empty name list is provided, the ctx.checkObjectPrivileges(ObjectPrivilegeType.ReadPacket, nameSet) function is called with an empty set, resulting in no WHERE pname IN filter being applied to the SELECT * FROM tm query. Consequently, the onTuple handler streams all retrieved packets without per-row authorization checks, allowing an authenticated user with low or zero privileges to dump the entire raw telemetry packet archive and bypass the role-based access control model.

Recommendations Update to version 5.12.8. Update to version 5.13.2.